Configure tool authorization
Choose which tools require confirmation and verify the policy in a new session.
Choose whether enabled tools run immediately or ask the user to confirm. This guide uses an orders MCP server with query and return tools. Your tool server must still enforce business permissions.
Prepare the tools
Start with a working service agent. Connect an MCP server named orders under 配置 → MCP 与凭据 (Configuration → MCP and credentials). The example requires enabled list_orders and request_return tools. Replace these names with your actual server and tools; do not configure nonexistent example tools.
A confirmation card is not authentication. A public MCP service must authenticate the platform caller before applying end-user data restrictions. See Secure tool access.
Choose an execution policy
| Policy | Effect on ordinary enabled tools |
|---|---|
always_allow | Executes without asking |
always_ask | Pauses for confirmation; allow executes the call, deny prevents it |
These are the two supported policies. Do not use auto: even where a type accepts it, the runtime rejects execution. Disable a tool to prevent its use entirely. Asking still lets the user approve a call.
Policies do not bypass mandatory tool interactions, security boundaries, or business checks. Client custom tools execute in your page and do not use these confirmation policies.
Configure tools and defaults
In the current Dashboard, open 服务智能体 → your agent → 接入与配置 → 配置 → 工具与授权 (Service agents → your agent → Integration and configuration → Configuration → Tools and authorization).
- Under 授权方式, set orders · 默认授权 to 每次询问 (Ask every time).
- Set
list_ordersto 自动执行 (Run automatically) andrequest_returnto 每次询问. Individual selectors only appear for configured tools. Other tools inherit the default; use the API to add individual settings if needed. - Save. Expected: the configuration version increases. Existing sessions retain their original version.
Resolution follows individual configs[].permission_policy, then default_config.permission_policy, then the tool default. Without an explicit MCP policy, only annotations.readOnlyHint === true defaults to allow. Otherwise, it defaults to ask. This server hint affects only the default; explicit settings take priority.
The built-in toolset defaults to always_allow when no default policy is specified, while mandatory tool interactions still apply. Explicitly require confirmation for refunds, deletion, and external messages instead of relying on server hints.
Verify confirmation
Issue an embed token for the new version and create a new session. If your policy pins a version, update that pin or specify the new version during issuance. Saving an agent does not upgrade existing sessions.
Request an order lookup, then a test return. Expected: the lookup runs immediately; the return shows a Kit confirmation card. Denying must prevent the server-side action. Request it again and allow it to proceed. Verify actual execution in your tool server's records rather than relying only on the model's answer.
Kit supplies the confirmation UI. An embedded user's approval applies to that call and does not save permanent tool permissions. For complete scenarios, see Test your integration.